User Roles
Comprehensive guide to the role-based access control (RBAC) model in the Rhindon AI Risk & Integrity Cloud platform.
Overview
RAIC uses a role-based access control (RBAC) model to govern what each user can see and do within the platform. Every authenticated user is assigned exactly one role within their organization, which determines their permissions across all modules.
Roles are enforced at multiple layers for defense-in-depth security:
- Database Layer (RLS) — Row-Level Security policies on every table enforce role-based access at the data level, preventing unauthorized reads or writes regardless of the UI
- Application Layer — Route guards and component-level visibility checks hide inaccessible modules and actions from the UI
- API Layer — Edge functions validate caller identity and role before executing privileged operations
Roles are assigned by OrgAdmins through the User Management page in the Admin Panel. The primary contact of a new organization is automatically assigned the OrgAdmin role during provisioning.
The platform also supports approval delegation, allowing Approvers, IntakeAdmins, and WorkflowAdmins to temporarily delegate their approval authority to another user of the same role during absences (with start/end dates and documented reasons). Each delegation can be scoped to specific workflow types — AI Systems, Use Cases, Controls, and/or Policy Versions — so a delegate only inherits authority for the categories the delegator selected.
Role Reference
OrgAdmin (vCAIO)All Tiers
Full organization administrator with unrestricted access to all modules, settings, and user management. Acts as the virtual Chief AI Officer. This is the default role assigned to the primary contact when a tenant is provisioned.
Access & Permissions
- Full CRUD on all AI Systems, Use Cases, and Controls
- Manage users: invite, edit roles, deactivate, delete, resend invitations, reset MFA
- Configure organization settings (alert cadences, lookup values, integrations, SSO/SCIM)
- Access Admin Panel: Org Settings, User Management, Activity Log, all module settings
- Manage Billing: view subscription, purchase plans via Stripe, manage payment methods
- Approve, reject, triage, and conditionally approve records across all modules
- Manage governance policies (upload, version, configure attestation schedules)
- Manage the Attestation Archive — permanent historical record
- View and export all reports including branded PDF exports
- Configure AI Discovery (Microsoft Graph integration)
- Manage approval delegations and governance designations
- Access AIREP intake dashboards and submit internal intake forms (Professional+)
- Share external intake links (Enterprise only)
- View full audit logs and change history
Restrictions
- Cannot access the Platform Management Portal (reserved for Platform Managers)
ApproverAll Tiers
Senior governance stakeholder responsible for making approval decisions on AI systems, use cases, and controls. Typically assigned to CISO, DPO, or Ethics Officer roles within the organization.
Access & Permissions
- Read all AI Systems, Use Cases, and Controls within their org
- Approve, conditionally approve, or reject submissions
- Add comments (internal and external) on system records
- Delegate approval authority to other Approvers
- View all reports and audit logs
- Receive approval-related email notifications
Restrictions
- Cannot create or edit AI Systems, Use Cases, or Controls
- Cannot manage users or organization settings
- Cannot access Admin Panel
- Cannot manage governance policies
ReviewerAll Tiers
Technical or compliance reviewer who evaluates submissions and provides assessments but does not make final approval decisions. Ideal for subject matter experts, security analysts, and compliance officers.
Access & Permissions
- Read all AI Systems, Use Cases, and Controls within their org
- Update/edit records during review stages
- Add comments (internal and external) on system records
- Perform risk assessments and technical evaluations
- Create new Controls
- View all reports and audit logs
Restrictions
- Cannot approve, reject, or triage records
- Cannot create new AI Systems
- Cannot manage users or organization settings
- Cannot access Admin Panel
SubmitterAll Tiers
Business or technical user who creates and submits AI system registrations for review. On Professional+ plans, Submitters can also submit internal AIREP intake forms for AI use cases and tools.
Access & Permissions
- Create new AI Systems (insert within org)
- Read and update their own submitted records
- View non-internal comments on their submissions
- Track submission status through the workflow
- Submit internal AI Use Case and AI Tool intake forms (Professional+)
Restrictions
- Cannot view other users' submissions
- Cannot view internal comments
- Cannot approve, reject, or triage any records
- Cannot access Admin Panel, Reports, Risk Register, or Compliance modules
- Cannot access AIREP review dashboards
ReadOnlyAll Tiers
View-only access for stakeholders who need visibility into the AI governance portfolio without modification rights. Suitable for board members, auditors, or executive sponsors.
Access & Permissions
- Read all AI Systems, Use Cases, and Controls within their org
- View non-internal comments
- View all reports
Restrictions
- Cannot create, edit, or delete any records
- Cannot add comments
- Cannot approve or reject submissions
- Cannot manage users, settings, or policies
- Cannot access Admin Panel
IntakeAdminProfessional+
Manages the AI Intake Request Engine (AIREP). Responsible for triaging incoming AI use case and tool requests submitted via internal forms or public intake links. Available on Professional+ plans.
Access & Permissions
- View AIREP Use Case and Tool Intake Dashboards
- Read and update AI Systems within their org (for intake processing)
- Triage incoming intake submissions (internal and external)
- Approve or reject intake submissions and promote to registers
- Read-only access to governance apps for context
- Delegate approval authority to other IntakeAdmins
Restrictions
- Cannot access Admin Panel or organization settings
- Cannot manage users
- Cannot approve or reject records outside AIREP
- Cannot share external intake links (OrgAdmin-only, Enterprise-only)
WorkflowAdminAll Tiers
Cross-module workflow manager with full CRUD access to AI Systems, Use Cases, Controls, governance policies, and attestation campaigns. On Professional+ plans, also manages the AIREP intake process. Features a consolidated, priority-sorted dashboard aggregating action items across all modules.
Access & Permissions
- Full CRUD on AI Systems, AI Use Cases, AI Tools, and Controls
- Approve, conditionally approve, reject, triage, and manage lifecycle transitions
- Manage governance policies and attestation campaigns
- View and manage the Attestation Archive
- Manage AIREP intake dashboards (Professional+ only)
- View Risk Register and Compliance modules
- View all reports
- Delegate approval authority
- Consolidated dashboard sorted Critical → Low priority
Restrictions
- Cannot access Admin Panel or organization settings
- Cannot manage users
- Cannot share external intake links (OrgAdmin-only, Enterprise-only)
AttestationOnlyProfessional+
Available on Professional+ plans (requires Policy Attestation). Designed for general employees who only need to acknowledge and attest to governance policies. Zero exposure to sensitive governance data. Ideal for broad organizational rollouts of policy acknowledgment.
Access & Permissions
- View governance policies assigned to them
- Complete policy attestations
- Receive branded email notifications for new attestations and reminders
- Access User Settings
Restrictions
- Cannot access any governance modules (System Register, Use Case Register, Controls, etc.)
- Cannot access Reports, Dashboard, AIREP, or Admin Panel
- Cannot view AI systems, use cases, or controls
- Redirected to attestation page upon login
- All other sidebar navigation items are hidden
Role Assignment Best Practices
- Assign OrgAdmin sparingly — typically only to the AI governance lead or CAIO
- Use WorkflowAdmin for governance team members who need cross-module management without admin panel access
- Use AttestationOnly for broad employee policy acknowledgment rollouts to minimize data exposure
- Leverage approval delegation rather than granting permanent elevated roles for coverage during absences
- Use ReadOnly for board members, auditors, or executives who need portfolio visibility